Joseph Ravichandran - The PACMAN Attack: Breaking PAC on the Apple M1 with Hardware Attacks

Joseph Ravichandran, First year PhD Student working with Dr. Mengjia Yan at MIT. He/Him

Presentation Title: The PACMAN Attack: Breaking PAC on the Apple M1 with Hardware Attacks
Length of presentation: 45
Demo, Tool, Exploit

ABSTRACT

What do you get when you cross pointer authentication with microarchitectural side channels?

The PACMAN attack is a new attack technique that can bruteforce the pointer authentication code (PAC) for an arbitrary kernel pointer without causing any crashes using microarchitectural side channels. We demonstrate the PACMAN attack against the Apple M1 CPU.

SPEAKER BIO

Joseph Ravichandran is a PhD student in computer architecture studying microarchitectural security at MIT. His work includes microarchitectural and memory safety attacks and attack modeling. He plays CTF with SIGPwny. This is his first DEF CON talk.

Twitter: https://twitter.com/0xjprx

More info about PACMAN: pacmanattack.com

REFERENCES:
Our references are included in the bibliography of our paper at pacmanattack.com/paper.

[]